Previous articleBack to news listNext article
|
Sponsored links |
Want to become one of our authors and see your work published on ALLSeek.iNFO ?
|
| ASPJar Guestbook Input Validation Holes Let Remote Users Inject SQL Commands |
|---|
Categorie: Vulnerability
Posted: 2005-02-12 by ReCall
Views: 457
Source: Click here
| Current Rating: Not rated
|
|
| Details |
|---|
Description: An input validation vulnerability was reported in the ASPJar guestbook. A remote user can gain administrative access and can delete guestbook messages.
The '/admin/login.asp' script does not properly validate user-supplied input in the password field. A remote user can supply the following characters in password field to inject SQL commands and be authenticated as the administrator:
' or ''='
In some versions of ASPJar, a remote user can invoke the '/admin/delete.asp' script to delete guestbook messages.
farhad koosha reported this vulnerability.
Impact: A remote user can gain administrative access and can delete guestbook messages.
Solution: No solution was available at the time of this entry.
|
| Syndication |
|---|
Permalink Email this
The URI to TrackBack this entry is:
http://allseek.info/news/trackback.php?id=1356
|
| User comments (post your comments ) |
|---|
Only registerd members can post comments and articles
|
|
Previous articleBack to news listNext article
|
